6 ms·

I don't understand how FB can decrypt other apps network traffic. TLS will fail if they tried a man in the middle attack even if they had VPN software install

by adrr 3y ago

I don't understand how FB can decrypt other apps network traffic. TLS will fail if they tried a man in the middle attack even if they had VPN software installed on the device.

yusaydat 3y ago
They asked users of the VPN service to install a certificate, that's how they did it.
- stbenjam 3y ago
  The TC article leaves that a little unclear: were they actually looking at the plaintext or just gathering metrics about snapchat usage? The latter wouldn't require decrypting the session. If Onavo did install a certificate and MITM the connections and send private user data to Meta... that's beyond the pale. That's far more worthy of a cover story than Bloomberg's debunked secretive tiny chips story from a few years ago. It's equally as bad if not worse. Hopefully the technical details will come out.
  - rpdillon 3y ago
    This is the first sentence of the article: > In 2016, Facebook launched a secret project designed to intercept and decrypt the network traffic between people using Snapchat’s app and its servers. I read the rest of the article as well, and saw only confirmation: > Given that Snapchat encrypted the traffic between the app and its servers, this network analysis technique was not going to be effective. This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device’s network traffic before it got encrypted and sent over the internet. Where do you see the ambiguity? Other than the weasel words about proposing these programs (versus actually running them), it seems clear that they were decrypting the traffic (or reading it before it was encrypted). Did I miss a piece?
    - stbenjam 3y ago
      > This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device’s network traffic before it got encrypted and sent over the internet. This doesn't make sense, they wouldn't see the traffic before it was encrypted. They would see it encrypted, but using the MITM certificate instead of Snapchat's. Given the inaccuracies in the article, it makes me wonder what else they got wrong. Using a VPN client to monitor how much, when, and where traffic is going is bad, but MITM'ing a user's connection is much, much worse. I'm really skeptical that's what happened, especially given TC's inability to articulate accurately what Facebook did.
      - blakesterz 3y ago
        That was pretty much the point of Onavo: https://techcrunch.com/2019/02/21/facebook-removes-onavo/ https://techcrunch.com/2019/02/21/facebook-removes-onavo/
        stbenjam 3y ago
        > Onavo [...] would collect the “Time you spend using apps, mobile and Wi-Fi data you use per app, the websites you visit, and your country, device and network type.” That's the former type of collection I was talking about. There's no evidence I can find that they installed a root CA certificate and were MITM'ing connections. That's a major accusation and one that is not accurate as far as I can tell. Apple banned the app because it was inspecting underlying traffic not installing a fake root certificate: https://techcrunch.com/2019/01/30/apple-bans-facebook-vpn/ https://techcrunch.com/2019/01/30/apple-bans-facebook-vpn/
        snowwrestler 3y ago
        You are quoting what Facebook claimed the app did. The language in the lawsuit complaint is explicit that FB installed a root cert to MITM and decrypt traffic: https://news.ycombinator.com/item?id=39835115 https://news.ycombinator.com/item?id=39835115
  - deleted 3y ago
    [deleted]
  - yusaydat 3y ago
    [dead]
  - thejefflarson 3y ago
    See page two of the document: https://storage.courtlistener.com/recap/gov.uscourts.cand.369872/gov.uscourts.cand.369872.735.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.36... Seems pretty clear that they could decrypt the traffic they were interested in, they also talk about 5 years of retention of all traffic that they can decrypt at anytime. Sound familiar? Looks like they used a squid feature: https://wiki.squid-cache.org/Features/SslBump https://wiki.squid-cache.org/Features/SslBump
snowwrestler 3y ago
> Facebook's IAAP Program used nation-state-level hacking technology developed by the company's Onavo team, in which Facebook paid contractors (including teens) to designate Facebook a trusted "root" Certificate Authority on their mobile devices, then generated fake digital certificates to redirect secure Snapchat analytics traffic (and later, analytics from YouTube and Amazon) from Snapchat's servers to Onavo's; decrypted these analytics and used them for competitive gain, including to inform Facebook's product strategy; reencrypted them; and sent them up to Snapchat's servers as though it came straight from Snapchat's app, with Facebook's Social Advertising competitor none the wiser. https://x.com/jason_kint/status/1772671792361992351 https://x.com/jason_kint/status/1772671792361992351
- specialist 3y ago
  That's (corporate) espionage.
  - Grimblewald 3y ago
    User behaviour is not company property.
  - pangolinja 3y ago
    [dead]
- esafak 3y ago
  Could Snapchat have detected this? What is the defense against this type of attack?
  - semiquaver 3y ago
    Certificate pinning would defeat this. Bake it into your app that you only trust a specific certificate regardless of what is in the system trust store.
    - hifromwork 3y ago
pangolinja 3y ago
[dead]

by adrr 3y ago

I don't understand how FB can decrypt other apps network traffic. TLS will fail if they tried a man in the middle attack even if they had VPN software installed on the device.

yusaydat 3y ago

They asked users of the VPN service to install a certificate, that's how they did it.

stbenjam 3y ago
The TC article leaves that a little unclear: were they actually looking at the plaintext or just gathering metrics about snapchat usage? The latter wouldn't require decrypting the session. If Onavo did install a certificate and MITM the connections and send private user data to Meta... that's beyond the pale. That's far more worthy of a cover story than Bloomberg's debunked secretive tiny chips story from a few years ago. It's equally as bad if not worse. Hopefully the technical details will come out.
- rpdillon 3y ago
  This is the first sentence of the article: > In 2016, Facebook launched a secret project designed to intercept and decrypt the network traffic between people using Snapchat’s app and its servers. I read the rest of the article as well, and saw only confirmation: > Given that Snapchat encrypted the traffic between the app and its servers, this network analysis technique was not going to be effective. This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device’s network traffic before it got encrypted and sent over the internet. Where do you see the ambiguity? Other than the weasel words about proposing these programs (versus actually running them), it seems clear that they were decrypting the traffic (or reading it before it was encrypted). Did I miss a piece?
  - stbenjam 3y ago
    > This is why Facebook engineers proposed using Onavo, which when activated had the advantage of reading all of the device’s network traffic before it got encrypted and sent over the internet. This doesn't make sense, they wouldn't see the traffic before it was encrypted. They would see it encrypted, but using the MITM certificate instead of Snapchat's. Given the inaccuracies in the article, it makes me wonder what else they got wrong. Using a VPN client to monitor how much, when, and where traffic is going is bad, but MITM'ing a user's connection is much, much worse. I'm really skeptical that's what happened, especially given TC's inability to articulate accurately what Facebook did.
    - blakesterz 3y ago
      That was pretty much the point of Onavo: https://techcrunch.com/2019/02/21/facebook-removes-onavo/ https://techcrunch.com/2019/02/21/facebook-removes-onavo/
      - stbenjam 3y ago
        > Onavo [...] would collect the “Time you spend using apps, mobile and Wi-Fi data you use per app, the websites you visit, and your country, device and network type.” That's the former type of collection I was talking about. There's no evidence I can find that they installed a root CA certificate and were MITM'ing connections. That's a major accusation and one that is not accurate as far as I can tell. Apple banned the app because it was inspecting underlying traffic not installing a fake root certificate: https://techcrunch.com/2019/01/30/apple-bans-facebook-vpn/ https://techcrunch.com/2019/01/30/apple-bans-facebook-vpn/
        snowwrestler 3y ago
        You are quoting what Facebook claimed the app did. The language in the lawsuit complaint is explicit that FB installed a root cert to MITM and decrypt traffic: https://news.ycombinator.com/item?id=39835115 https://news.ycombinator.com/item?id=39835115
- deleted 3y ago
  [deleted]
- yusaydat 3y ago
  [dead]
- thejefflarson 3y ago
  See page two of the document: https://storage.courtlistener.com/recap/gov.uscourts.cand.369872/gov.uscourts.cand.369872.735.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.cand.36... Seems pretty clear that they could decrypt the traffic they were interested in, they also talk about 5 years of retention of all traffic that they can decrypt at anytime. Sound familiar? Looks like they used a squid feature: https://wiki.squid-cache.org/Features/SslBump https://wiki.squid-cache.org/Features/SslBump

snowwrestler 3y ago

> Facebook's IAAP Program used nation-state-level hacking technology developed by the company's Onavo team, in which Facebook paid contractors (including teens) to designate Facebook a trusted "root" Certificate Authority on their mobile devices, then generated fake digital certificates to redirect secure Snapchat analytics traffic (and later, analytics from YouTube and Amazon) from Snapchat's servers to Onavo's; decrypted these analytics and used them for competitive gain, including to inform Facebook's product strategy; reencrypted them; and sent them up to Snapchat's servers as though it came straight from Snapchat's app, with Facebook's Social Advertising competitor none the wiser. https://x.com/jason_kint/status/1772671792361992351 https://x.com/jason_kint/status/1772671792361992351

specialist 3y ago
That's (corporate) espionage.
- Grimblewald 3y ago
  User behaviour is not company property.
- pangolinja 3y ago
  [dead]
esafak 3y ago
Could Snapchat have detected this? What is the defense against this type of attack?
- semiquaver 3y ago
  Certificate pinning would defeat this. Bake it into your app that you only trust a specific certificate regardless of what is in the system trust store.
  - hifromwork 3y ago

pangolinja 3y ago

[dead]